
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@nxtedition/yield
Advanced tools
Cooperative yielding for Node.js to keep servers and applications responsive.
Cooperative yielding for Node.js to keep servers and applications responsive.
When using synchronous APIs like DatabaseSync, sync fs API's such as fs.readFileSync, or fs.statSync — or simply performing lots of synchronous computation — the event loop is blocked and cannot process I/O, timers, or incoming requests. Even long-running chains of asynchronous microtasks (e.g. deeply nested Promise.then chains) can starve the event loop in the same way.
This library provides a simple mechanism to periodically yield control back to the event loop during these long-running operations, preventing event loop starvation and keeping your application responsive.
npm install @nxtedition/yield
import { maybeYield } from '@nxtedition/yield'
import { DatabaseSync } from 'node:sqlite'
const db = new DatabaseSync('data.db')
for (const row of db.prepare('SELECT * FROM large_table').iterate()) {
processRow(row)
const yielded = maybeYield()
if (yielded) {
await yielded // give the event loop a turn
}
}
import { maybeYield } from '@nxtedition/yield'
import fs from 'node:fs'
function processFiles(files, i = 0) {
for (; i < files.length; i++) {
const data = fs.readFileSync(files[i])
transform(data)
if (maybeYield(processFiles, files, i + 1)) {
return // will resume via callback after yielding
}
}
}
import { doYield } from '@nxtedition/yield'
// Promise-based
await doYield()
// Callback-based
doYield((opaque) => {
continueWork(opaque)
}, data)
import { shouldYield, doYield } from '@nxtedition/yield'
while (hasWork()) {
doWork()
if (shouldYield()) {
doMoreWork()
break
}
}
shouldYield(timeout?): booleanReturns true when the current synchronous execution has exceeded the timeout threshold (default: 40ms). Does not yield — only checks whether yielding is recommended.
maybeYield(timeout?): Promise<void> | nullIf a yield is needed, queues a yield and returns a Promise. Otherwise returns null. Use this in async functions.
maybeYield(callback, opaque?, timeout?): voidIf a yield is needed, defers callback(opaque) to after the yield. Otherwise calls callback(opaque) synchronously.
doYield(): Promise<void>Unconditionally queues a yield and returns a Promise that resolves after the event loop has been given a turn.
doYield(callback, opaque?): voidUnconditionally defers callback(opaque) to after the next yield.
setYieldTimeout(timeout): voidSet the default yield timeout in milliseconds. Must be a non-negative number. Default: 40.
setYieldDispatcher(dispatcher): voidOverride the scheduling function used to defer work. The dispatcher receives a callback and should invoke it asynchronously (e.g. via setTimeout or setImmediate). Pass null to restore the default dispatcher.
The library tracks when the last yield occurred using performance.now(). When shouldYield() detects that more than timeout milliseconds have elapsed, it signals that a yield is due. doYield and maybeYield batch pending callbacks into a queue that is drained in a single microtask turn, yielding again if the timeout is exceeded during draining.
MIT
FAQs
Cooperative yielding for Node.js to keep servers and applications responsive.
The npm package @nxtedition/yield receives a total of 135 weekly downloads. As such, @nxtedition/yield popularity was classified as not popular.
We found that @nxtedition/yield demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.